fix use of secure_filename